NIS2 Registration: The Obligation Thousands of German Entities Still Have Not Met

Germany's BSI estimates that about 29,500 entities fall under the NIS2 implementation act. The statutory registration deadline passed on 6 March 2026. By 30 June 2026, according to the BSI, 17,729 companies had registered. Measured against the BSI's own estimate, that leaves close to 12,000 organisations that are likely in scope, legally required to register, and have not.

The BSI's response so far has not been a fine. It has been a plain instruction on its NIS-2 page: the statutory deadline has passed, and anyone in scope who has not registered must do so immediately.

If you run an MSP or a consultancy with German clients, every unregistered client is already overdue. And registration is the one obligation you cannot fix in a sprint after the fact, because the register is timestamped.

Registration is a separate obligation from Article 21, and it lands first

Most compliance conversations start with the security measures. Risk analysis, incident handling, backups, MFA, supply chain. Article 21 work.

Registration sits somewhere else entirely. It comes from Article 3(4) of NIS2, which requires member states to establish a list of essential and important entities, and from Article 27, which requires certain digital infrastructure entities to submit identifying data. Member states operationalise this by making the entity register itself.

The practical difference matters: Article 21 obligations are assessed over time, in an audit, with room to show progress. Registration is binary. You are in the register on a given date, or you are not.

That is why registration is the first thing a supervisory authority looks at. It costs the regulator nothing to run a query against the register and compare it to a sector list from the chamber of commerce. Unregistered entities are the cheapest enforcement target in the whole directive.

Every member state runs its own register, on its own clock

There is no EU-wide NIS2 registration portal. Each transposition creates its own register, its own portal, and its own deadline — and those deadlines are now spread across a two-year window.

Germany: the NIS2UmsuCG took effect 6 December 2025, the BSI portal opened 6 January 2026, the statutory registration deadline was 6 March 2026, three months after entry into force (§ 33 BSIG). Registration is now overdue for anyone in scope who has not done it.

Belgium: registration with the Centre for Cybersecurity Belgium via Safeonweb@work closed on 18 March 2025. Belgium transposed early, so Belgian entities that only started NIS2 work in 2026 are already more than a year late.

The Netherlands: the Eerste Kamer adopted the Cyberbeveiligingswet on 7 July 2026. It enters into force on 15 August 2026, and registration via the NCSC entity register becomes mandatory from that date. Roughly 8,000 Dutch organisations are expected to fall in scope, supervised by the RDI across nine sectors.

Italy: registration under Legislative Decree 138/2024 runs through the ACN portal on an annual cycle, with a defined window each year rather than a one-off deadline.

For an MSP with clients in four countries, that is four portals, four legal bases, four sets of required data fields, and four dates. There is no version of this where a single spreadsheet column called "NIS2: yes/no" is enough.

Your client's registration status is your problem before it is theirs

Here is the pattern we keep seeing. An MSP does solid technical work for a client — segmentation, EDR rollout, backup testing, MFA on everything that will take it. Twelve months of genuine security improvement.

Then the supervisory authority contacts the client, and the first question is not about MFA. It is: why are you not in the register?

The client's answer, almost always: "I assumed our IT provider handled that."

They are wrong about the legal position. Registration is the entity's own obligation and cannot be delegated away — the management body carries it under Article 20. But being legally right does not help you when a client's board is asking why nobody flagged it.

The fix is procedural, not technical. For every client, you need three data points on record: whether they are in scope, in which member states, and whether registration is confirmed with a reference number and date. If a client is out of scope, that determination needs to be written down with the reasoning — headcount, turnover, sector under Annex I or II — because "we decided they were out of scope" is not a defence unless you can show the assessment.

The scope call is harder than it looks, and defaults toward "in"

Two things push more entities into scope than most consultants expect.

First, the size-cap rule is not the only route in. An entity is normally out unless it has 50 or more employees, or fewer than 50 with both annual turnover and balance sheet total above €10 million — but Article 2(2) pulls specific entities in regardless of size, including sole providers of a critical service in a member state, certain DNS and TLD entities, trust service providers, and public administration entities. Germany's transposition has been read broadly here, which is part of why the BSI's estimate landed near 29,500.

Second, group structures. Headcount and turnover thresholds are assessed with linked and partner enterprises included, following the EU SME definition. A 30-person Dutch subsidiary of a 900-person group is not a small entity for NIS2 purposes. We see this misread constantly, and it is the single most common reason an entity that believed it was out of scope receives a letter.

If you are running this determination across a client base, do it once, properly, and document it. A structured gap analysis makes the scope call defensible instead of a matter of opinion. You can start that in about ten minutes with our free quick scan, then take the output into a full assessment.

What happens after the deadline is not just a fine

The German framework allows fines of up to €10 million for particularly important entities that fail to take the required security measures, or up to 2% of worldwide turnover for a company with a total turnover above €500 million (§ 65 BSIG). A missed registration alone can cost up to €500,000. The big numbers get the headlines. It is rarely the thing that actually hurts.

Failure to register is an administrative offence that puts an entity on a supervisory authority's list as a known non-compliant party. That triggers a different posture: the authority now has a reason to look, and once it looks, it looks at Article 21 too. A registration failure is not an isolated penalty — it is an invitation to a full inspection of security measures the entity has likely not finished implementing.

Then it moves down the chain. Registration status is increasingly turning up in supplier due-diligence questionnaires under Article 21(2)(d). An unregistered supplier is a documented supply-chain risk for every essential entity it serves, which means the commercial consequence arrives before the regulatory one. Contract renewals get harder. New tenders get lost.

What to do now

For German clients specifically, in this order.

Confirm scope. Sector under Annex I or II, size including group entities, and any Article 2(2) override. Write down the answer either way.

Check the register. If a client believes they registered, verify the confirmation and keep the reference. Registrations submitted with incomplete data have been bounced back, and some clients never noticed.

Register now. The BSI portal has been live since 6 January 2026. The submission itself takes under an hour once you have the entity data, contact points, and sector classification ready. There is no reason to stay among the unregistered.

For Dutch clients: 15 August is your date. The register goes live with the law. Get the entity data assembled now, because registering in week one is trivially easy and registering in month four is a conversation with the RDI.

For everyone else: build the register status column into your client tracker permanently. Registration is not a one-time task. Entity data changes, contact points change, and most member states require you to keep the register current — which means the obligation renews every time your client restructures, moves headquarters, or changes their security contact.

The organisations that get caught in the first enforcement wave will not be the ones with imperfect Article 21 controls. Almost nobody has perfect Article 21 controls yet. They will be the ones a regulator could identify with a single database query.

Related reading: NIS2 enforcement in Germany, the Dutch Cyberbeveiligingswet explained, and does NIS2 apply to me.